Skip to content

Commit 774383d

Browse files
kwwallkwwall
committed
Assistance to create ESAPI release notes.
1 parent b994c1a commit 774383d

File tree

5 files changed

+294
-0
lines changed

5 files changed

+294
-0
lines changed

‎scripts/createVarsFile.sh‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
#!/bin/bash
2+
# Purpose: Answer some questions and provide a new 'vars.<version>' from 'vars.template' to use for creating release notes.
3+
4+
prog="${0##*/}"
5+
6+
function iprompt # prompt_message
7+
{
8+
typeset ANS
9+
read -p "$@ (y|n): " ANS
10+
case "$ANS" in
11+
[Yy]|[Yy][Ee][Ss]) return 0 ;;
12+
*) return 1 ;;
13+
esac
14+
}
15+
16+
read -p "Enter release # for NEW ESAPI version you are doing release notes for: " VERSION
17+
if [[ -f "vars.$VERSION" ]]
18+
then
19+
iprompt "File 'vars.$VERSION' already exists. Continuing will overwrite it. Continue?" || exit 1
20+
fi
21+
22+
23+
read -p "Enter release # for the PREVIOUS ESAPI version: " PREV_VERSION
24+
read -p "Enter (planned) release date of NEW / current version you are preparing in YYYY-MM-DD format: " YYYY_MM_DD_RELEASE_DATE
25+
read -p "Enter release date of PREVIOUS ESAPI version in YYYY-MM-DD format: " PREV_RELEASE_DATE
26+
27+
echo You entered:
28+
echo =================================================
29+
echo VERSION=$VERSION
30+
echo PREV_VERSION=$PREV_VERSION
31+
echo YYYY_MM_DD_RELEASE_DATE=$YYYY_MM_DD_RELEASE_DATE
32+
echo PREV_RELEASE_DATE=$PREV_RELEASE_DATE
33+
echo =================================================
34+
echo
35+
36+
if iprompt "Are ALL your previous answers correct?"
37+
then
38+
# Create the new vars.${VERSION} file based on vars.template
39+
sed -e "s/^VERSION/VERSION=$VERSION/" \
40+
-e "s/^PREV_VERSION/PREV_VERSION=$PREV_VERSION/" \
41+
-e "s/^YYYY_MM_DD_RELEASE_DATE/YYYY_MM_DD_RELEASE_DATE=$YYYY_MM_DD_RELEASE_DATE/" \
42+
-e "s/^PREV_RELEASE_DATE/PREV_RELEASE_DATE=$PREV_RELEASE_DATE/" \
43+
vars.template > "vars.$VERSION"
44+
else
45+
echo "$prog: Aborting. Rerun the script to correct your answers." >&2
46+
exit 1
47+
fi

‎scripts/esapi4java-core-TEMPLATE-release-notes.txt‎

Lines changed: 182 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,182 @@
1+
@@@@ IMPORTANT: Be sure to 1) save in DOS text format, and 2) Delete this line and others starting with @@@@
2+
@@@ Edit with :set tw=0
3+
@@@@ Meant to be used with scripts/newReleaseNotes.sh and the 'vars.*' scripts there.
4+
Release notes for ESAPI ${VERSION}
5+
Release date: ${YYYY_MM_DD_RELEASE_DATE}
6+
Project leaders:
7+
-Kevin W. Wall <[email protected]>
8+
-Matt Seil <[email protected]>
9+
10+
Previous release: ESAPI ${PREV_VERSION}, ${PREV_RELEASE_DATE}
11+
12+
13+
Executive Summary: Important Things to Note for this Release
14+
------------------------------------------------------------
15+
@@@@ View previous release notes to see examples of what to put here. This is typical. YMMV.
16+
This is a patch release with the primary intent of updating some dependencies, some with known vulnerabilities. Details follow.
17+
18+
For those of you using a Software Configuration Analysis (SCA) services such as Snyk, BlackDuck, Veracode SourceClear, OWASP Dependency Check, etc., you might notice that there is vulnerability in xerces:xercesImpl:2.12.0 that ESAPI uses (also a transitive dependency) that is similar to CVE-2020-14621. Unfortunately there is no official patch for this in the regular Maven Central repository. Further details are described in Security Bulletin #3, which is viewable here
19+
https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin3.pdf
20+
and associated with this release on GitHub. Manual workarounds possible. See the security bulletin for further details.
21+
22+
23+
=================================================================================================================
24+
25+
Basic ESAPI facts
26+
-----------------
27+
28+
ESAPI ${PREV_VERSION} release:
29+
@@@@ Look up the figures from the previous release notes.
30+
#### Java source files
31+
#### JUnit tests in #### Java test files
32+
33+
ESAPI ${version} release:
34+
@@@@ Count them and run 'mvn test' to get the # of tests.
35+
#### Java source files
36+
#### JUnit tests in #### Java source files
37+
38+
XXX GitHub Issues closed in this release, including those we've decided not to fix (marked '(wontfix)').
39+
(Reference: https://github.com/ESAPI/esapi-java-legacy/issues?q=is%3Aissue+state%3Aclosed+updated%3A%3E%3D${PREV_RELEASE_DATE})
40+
41+
Issue # GitHub Issue Title
42+
----------------------------------------------------------------------------------------------
43+
@@@@ Capture issue #s and 1 line desription from above GitHub url
44+
@@@@ Insert here and massage until it looks pretty. Recommend alignment with spaces instead of tabs.
45+
46+
-----------------------------------------------------------------------------
47+
48+
Changes Requiring Special Attention
49+
50+
-----------------------------------------------------------------------------
51+
@@@@ NOTE any special notes here. Probably leave this one, but I would suggest noting additions BEFORE this.
52+
[If you have already successfully been using ESAPI 2.2.1.0 or later, you probably can skip this section.]
53+
54+
Since ESAPI 2.2.1.0, the new default ESAPI logger is JUL (java.util.logging packages) and we have deprecated the use of Log4J 1.x because we now support SLF4J and Log4J 1.x is way past its end-of-life. We did not want to make SLF4J the default logger (at least not yet) as we did not want to have the default ESAPI use require additional dependencies. However, SLF4J is likely to be the future choice, at least once we start on ESAPI 3.0. A special shout-out to Jeremiah Stacey for making this possible by re-factoring much of the ESAPI logger code. Note, the straw that broke the proverbial camel's back was the announcement of CVE-2019-17571 (rated Critical), for which there is no fix available and likely will never be.
55+
56+
However, if you try to juse the new ESAPI 2.2.1.0 or later logging you will notice that you need to change ESAPI.Logger and also possibly provide some other properties as well to get the logging behavior that you desire.
57+
58+
To use ESAPI logging in ESAPI 2.2.1.0 (and later), you will need to set the ESAPI.Logger property to
59+
60+
org.owasp.esapi.logging.java.JavaLogFactory - To use the new default, java.util.logging (JUL)
61+
org.owasp.esapi.logging.log4j.Log4JLogFactory - To use the end-of-life Log4J 1.x logger
62+
org.owasp.esapi.logging.slf4j.Slf4JLogFactory - To use the new (to release 2.2.0.0) SLF4J logger
63+
64+
In addition, if you wish to use JUL for logging, you *MUST* supply an "esapi-java-logging.properties" file in your classpath. This file is included in the 'esapi-2.2.2.0-configuration.jar' file provided under the 'Assets' section of the GitHub Release at
65+
https://github.com/ESAPI/esapi-java-legacy/releases/esapi-2.2.2.0
66+
67+
Unfortunately, there was a logic error in the static initializer of JavaLogFactory (now fixed in this release) that caused a NullPointerException to be thrown so that the message about the missing "esapi-java-logging.properties" file was never seen.
68+
69+
If you are using JavaLogFactory, you will also want to ensure that you have the following ESAPI logging properties set:
70+
# Set the application name if these logs are combined with other applications
71+
Logger.ApplicationName=ExampleApplication
72+
# If you use an HTML log viewer that does not properly HTML escape log data, you can set LogEncodingRequired to true
73+
Logger.LogEncodingRequired=false
74+
# Determines whether ESAPI should log the application name. This might be clutter in some single-server/single-app environments.
75+
Logger.LogApplicationName=true
76+
# Determines whether ESAPI should log the server IP and port. This might be clutter in some single-server environments.
77+
Logger.LogServerIP=true
78+
# LogFileName, the name of the logging file. Provide a full directory path (e.g., C:\\ESAPI\\ESAPI_logging_file) if you
79+
# want to place it in a specific directory.
80+
Logger.LogFileName=ESAPI_logging_file
81+
# MaxLogFileSize, the max size (in bytes) of a single log file before it cuts over to a new one (default is 10,000,000)
82+
Logger.MaxLogFileSize=10000000
83+
# Determines whether ESAPI should log the user info.
84+
Logger.UserInfo=true
85+
# Determines whether ESAPI should log the session id and client IP.
86+
Logger.ClientInfo=true
87+
88+
See GitHub issue #560 for additional details.
89+
90+
91+
Related to that aforemented Log4J 1.x CVE and how it affects ESAPI, be sure to read
92+
https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin2.pdf
93+
which describes CVE-2019-17571, a deserialization vulnerability in Log4J 1.2.17. ESAPI is *NOT* affected by this (even if you chose to use Log4J 1 as you default ESAPI logger). This security bulletin describes why this CVE is not exploitable as used by ESAPI.
94+
95+
96+
Finally, while ESAPI still supports JDK 7 (even though that too is way past end-of-life), the next ESAPI release will move to JDK 8 as the minimal baseline. (We already use Java 8 for development but still to Java 7 source and runtime compatibility.) We need to do this out of necessity because some of our dependencies are no longer doing updates that support Java 7.
97+
98+
-----------------------------------------------------------------------------
99+
100+
Remaining Known Issues / Problems
101+
102+
-----------------------------------------------------------------------------
103+
If you use Java 7 (the minimal Java baseline supported by ESAPI) and try to run 'mvn test' there is one test that fails. This test passes with Java 8. The failing test is:
104+
105+
[ERROR] Tests run: 5, Failures: 1, Errors: 0, Skipped: 0, Time elapsed: 0.203 s
106+
<<< FAILURE! - in org.owasp.esapi.crypto.SecurityProviderLoaderTest
107+
[ERROR] org.owasp.esapi.crypto.SecurityProviderLoaderTest.testWithBouncyCastle
108+
Time elapsed: 0.116 s <<< FAILURE!
109+
java.lang.AssertionError: Encryption w/ Bouncy Castle failed with
110+
EncryptionException for preferred cipher transformation; exception was:
111+
org.owasp.esapi.errors.EncryptionException: Encryption failure (unavailable
112+
cipher requested)
113+
at
114+
org.owasp.esapi.crypto.SecurityProviderLoaderTest.testWithBouncyCastle(Security
115+
ProviderLoaderTest.java:133)
116+
117+
I will spare you all the details and tell you that this has to do with Java 7 not being able to correctly parse the signed Bouncy Castle JCE provider jar. More details are available at:
118+
https://www.bouncycastle.org/latest_releases.html
119+
and
120+
https://github.com/bcgit/bc-java/issues/477
121+
I am sure that there are ways of making Bouncy Castle work with Java 7, but since ESAPI does not rely on Bouncy Castle (it can use any compliant JCE provider), this should not be a problem. (It works fine with the default SunJCE provider.) If it is important to get the BC provider working with the ESAPI Encryptor and Java 7, then open a GitHub issue and we will take a deeper look at it and see if we can suggest something.
122+
123+
124+
125+
Another problem is if you run 'mvn test' from the 'cmd' prompt (and possibly PowerShell as well), you will get intermittent failures (generally between 10-25% of the time) at arbitrary spots. If you run it again without any changes it will work fine without any failures. We have discovered that it doesn't seem to fail if you run the tests from an IDE like Eclipse or if you redirect both stdout and stderr to a file; e.g.,
126+
127+
C:\code\esapi-java-legacy> mvn test >testoutput.txt 2>&1
128+
129+
We believe these failures is because the maven-surefire-plugin is by default not forking a new JVM process for each test class. We are looking into this. For now, we have only have observed this behavior on Windows 10. If you see this error, please do NOT report it as a GitHub issue unless you know a fix for it. (And yes, we are aware of '<reuseForks>false</reuseForks>' in the pom for the maven-surefire-plugin, but that causes other tests to fail that we haven't had time to fix.)
130+
131+
132+
Lastly, some SCA services may continue to flag vulnerabilties in ESAPI ${VERSION} related to log4j 1.2.17 (e.g., CVE-2020-9488). We do not believe the way that ESAPI uses log4j in a manner that leads to any exploitable behavior. See the security bulletins
133+
https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin2.pdf
134+
for additional details.
135+
136+
-----------------------------------------------------------------------------
137+
138+
Other changes in this release, some of which not tracked via GitHub issues
139+
140+
-----------------------------------------------------------------------------
141+
142+
* Minor updates to README.md file
143+
144+
-----------------------------------------------------------------------------
145+
146+
Developer Activity Report (Changes between release ${PREV_VERSION} and ${VERSION}, i.e., between ${PREV_RELEASE_DATE} and ${YYYY_MM_DD_RELEASE_DATE})
147+
Generated manually (this time) -- all errors are the fault of kwwall and his inability to do simple arithmetic.
148+
149+
Developer Total Total Number # Merged
150+
(GitHub ID) commits of Files Changed PRs
151+
========================================================
152+
jeremiahjstacey 8 6 1
153+
dependabot 1 1 1
154+
kwwall 7 8 0
155+
========================================================
156+
Total PRs: 2
157+
158+
There were also several snyk-bot PRs that were rejected for various reasons, mostly because 1) I was already making the proposed changes and preferred to do them in single commit or 2) there were other reasons for rejecting them (such as the dependency requiring Java 8). The proposed changes that were not outright rejected were included as part of commit a8a79bc5196653500ce664b7b063284e60bddaa0.
159+
160+
-----------------------------------------------------------------------------
161+
162+
CHANGELOG: Create your own. May I suggest:
163+
164+
git log --stat --since=${PREV_RELEASE_DATE} --reverse --pretty=medium
165+
166+
which will show all the commits since just after the previous (${PREV_VERSION}) release.
167+
168+
-----------------------------------------------------------------------------
169+
170+
Direct and Transitive Runtime and Test Dependencies:
171+
172+
$ mvn dependency:tree
173+
@@@@ Include output from 'mvn dependency:tree' here
174+
175+
-----------------------------------------------------------------------------
176+
177+
Acknowledgments:
178+
Another hat tip to Dave Wichers for promptly releasing AntiSamy 1.6.1. And thanks to Matt Seil, Jeremiah Stacey, and all the ESAPI users who make this worthwhile. This is for you.
179+
180+
A special thanks to the ESAPI community from the ESAPI project co-leaders:
181+
Kevin W. Wall (kwwall) <== The irresponsible party for these release notes!
182+
Matt Seil (xeno6696)

‎scripts/newReleaseNotes.sh‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
#!/bin/bash
2+
# Purpose: Provide an assistance towards writing new ESAPI release notes. Still a lot of manual editing though.
3+
#
4+
# Usage: ./newReleaseNotes.sh new_esapi_vers_#
5+
# Should be run from the 'scripts' directory.
6+
7+
prog=${0##*/}
8+
template="esapi4java-core-TEMPLATE-release-notes.txt"
9+
10+
newVers=${1?Missing new ESAPI version number}
11+
12+
if [[ -r vars.${newVers} ]]
13+
then source vars.${newVers}
14+
else echo "$prog: Can't find vars.${newVers} to source. Did you forget to create it based on vars.template?" >&2
15+
echo " Execute './createVarsFile.sh' from the 'scripts' directory to create vars.${newVers}." >&2
16+
exit 1
17+
fi
18+
19+
hereDocBanner="__________@@@@@___@@@@@__________"
20+
tmpfile="/tmp/relNotes.$$"
21+
trap "rm $tmpfile" EXIT
22+
23+
if [[ -r $template ]]
24+
then
25+
echo "#!/bin/bash" > $tmpfile
26+
echo "source vars.${newVers}" >> $tmpfile
27+
echo "cat >esapi4java-core-${VERSION}-release-notes.txt <<${hereDocBanner}" >> $tmpfile
28+
cat $template >> $tmpfile
29+
echo "${hereDocBanner}" >> $tmpfile
30+
echo "ls -l esapi4java-core-${VERSION}-release-notes.txt" >> $tmpfile
31+
bash $tmpfile
32+
else echo "$prog: Can't find or read release notes template file $template" >&2
33+
exit 1
34+
fi
35+
36+
echo
37+
echo "Now move the file 'esapi4java-core-${VERSION}-release-notes.txt' to the 'documenation/' directory"
38+
echo "and finish editing it there. Be sure to remove all the instructional lines starting with @@@"
39+
echo "before committing it to GitHub."

‎scripts/vars.2.2.3.0‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# Do NOT edit this file directly. It will be created by the new newReleaseNotes.sh script.
2+
3+
# ESAPI (new / current) version
4+
VERSION=2.2.3.0
5+
6+
# Previous ESAPI version
7+
PREV_VERSION=2.2.2.0
8+
9+
# Release date of current version in yyyy-mm-dd format
10+
YYYY_MM_DD_RELEASE_DATE=2021-03-23
11+
12+
# Previous ESAPI release date in same format
13+
PREV_RELEASE_DATE=2021-11-27

‎scripts/vars.template‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# Do NOT edit this file directly. It will be created by the new newReleaseNotes.sh script.
2+
3+
# ESAPI (new / current) version
4+
VERSION
5+
6+
# Previous ESAPI version
7+
PREV_VERSION
8+
9+
# Release date of current version in yyyy-mm-dd format
10+
YYYY_MM_DD_RELEASE_DATE
11+
12+
# Previous ESAPI release date in same format
13+
PREV_RELEASE_DATE

0 commit comments

Comments
 (0)